other

SANDCLOCK

Python credential stealer built to run on Linux and interact with Kubernetes, including container escape capability, publicly associated with the malware referred to as CanisterWorm.

Current clusters

security3 publishers

Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours

Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.

Publishers:bleepingcomputer.comhelpnetsecurity.comthehackernews.com

Reality

Evidence62
Adoption58
Hype gap+16
Incentives70
Confidence60